Unauthenticated PHP Object Injection exists in WordPress Booktics plugin up to version 1.0.21. Based on the description, it is inferred that an attacker can supply crafted serialized PHP objects without authentication, potentially leading to arbitrary code execution, data tampering, or site compromise. The vulnerability is catalogued as CWE‑502 and carries a CVSS score of 9.8, indicating a severe risk to confidentiality, integrity, and availability.

The issue affects installations of the WordPress Booktics plugin version 1.0.21 or earlier, developed by Arraytics. Any WordPress site using these versions—typically sites that have not migrated to the patched release 1.0.22 or newer—is susceptible.

The very high CVSS score signals that exploitation can achieve full control over the hosting environment. However, the EPSS score (<1%) suggests that known exploitation attempts are rare, and the vulnerability is not listed in the CISA KEV catalog, implying no documented public exploits yet. The attack vector is inferred to involve sending maliciously crafted serialized data through the plugin’s publicly exposed interfaces, which the plugin processes without proper authentication or validation.